Simple Membership <= 4.8.3 - Unauthenticated Email Verification Bypass via Activation Email Resend

ID

WPSEC-2026-0272

Plugin

Simple Membership (simple-membership)

Affected

from 3.7.5 before 4.8.4

Remediation

Update to 4.8.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-287

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Simple Membership on WPSec AttackSurface

Fix released

2026-09-28

Published

2026-10-02

Description

The Simple Membership plugin for WordPress is vulnerable to email verification bypass in versions 3.7.5 up to, and including, 4.8.3. The public activation email resend handler (swpm_resend_activation_email) sends the activation email to the address in the request's 'email' POST parameter, when one is present, instead of the member's saved email address. This makes it possible for unauthenticated attackers to have the activation link for any account awaiting email activation sent to an address they control, and to activate that account without access to the registered mailbox, for example to verify an account they registered with someone else's email address. Each resend request also replaces the member's pending activation link. Activation tokens were additionally derived from a time-based uniqid() value and never expired. The member's password is not disclosed. Exploitation requires email activation to be enabled for a membership level.

References

• https://wpsec.com/vuln/WPSEC-2026-0272/
• https://plugins.svn.wordpress.org/simple-membership/tags/4.8.4/
• https://wordpress.org/plugins/simple-membership/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS